Groups clash on results of Carnivore report

Carnivore: Draft Indpendent Technical Review of the Carnivore System

A research institution's evaluation of the FBI's Carnivore system concluded

that laws ensure that the system only intercepts approved information. But

a privacy group says much of that information is below the law's radar.

The Justice Department ordered the study to determine if Carnivore performed

as FBI officials claimed — that is, capturing e-mail messages specified

by a court order without intercepting additional information.

IIT Research Institute concluded that Carnivore is "more effective in protecting

privacy and enabling lawful surveillance than...alternatives." The report

said laws exist to guard against FBI misuse of Carnivore.

But according to James Dempsey, the bureau is free to collect the "to" and

"from" lines of e-mail messages and the Internet addresses that a computer

user visits and downloads files from — all without judicial oversight. Dempsey

is a senior staff attorney for the Center for Democracy and Technology,

a Washington, D.C., public policy group.

Justice Department officials could not be reached for comment. However,

FBI officials testifying before Congress have emphasized that Carnivore

is used largely to intercept only e-mail addresses.

Barry Watson, a spokesman for IITRI, said reviewers may not have considered

that so-called pen register surveillance carries a lower level of judicial

scrutiny and protection than a full content intercept. Pen register surveillance

is similar to a trap-and-trace order on a telephone when investigators only

record the phone numbers of a suspect's incoming and outgoing calls.

IITRI could address that issue in its final report, due Dec. 8, Watson said.

Dempsey said the current laws are good at safeguarding full e-mail messages

because a judge must confirm that any e-mail information intercepted was

legally authorized. There are criminal penalties for agents violating the

rules.

But when Carnivore is used to capture only addresses, those protections

do not exist. A judge must sign an intercept order but is not required to

do a follow-up review, Dempsey said.